<!DOCTYPE html>
<html lang="en-us">
  <head>

    <meta http-equiv="content-type" content="text/html; charset=utf-8">
    
<meta charset="UTF-8">
<title>Dissect Processor | Elasticsearch Guide [7.7] | Elastic</title>
<link rel="home" href="index.html" title="Elasticsearch Guide [7.7]">
<link rel="up" href="ingest-processors.html" title="Processors">
<link rel="prev" href="date-index-name-processor.html" title="Date Index Name Processor">
<link rel="next" href="dot-expand-processor.html" title="Dot Expander Processor">
<meta name="DC.type" content="Learn/Docs/Elasticsearch/Reference/7.7">
<meta name="DC.subject" content="Elasticsearch">
<meta name="DC.identifier" content="7.7">
<meta name="robots" content="noindex,nofollow">
    <meta http-equiv="X-UA-Compatible" content="IE=edge">
    <meta name="viewport" content="width=device-width, initial-scale=1">
    <script src="https://cdn.optimizely.com/js/18132920325.js"></script>
    <link rel="apple-touch-icon" sizes="57x57" href="/apple-icon-57x57.png">
    <link rel="apple-touch-icon" sizes="60x60" href="/apple-icon-60x60.png">
    <link rel="apple-touch-icon" sizes="72x72" href="/apple-icon-72x72.png">
    <link rel="apple-touch-icon" sizes="76x76" href="/apple-icon-76x76.png">
    <link rel="apple-touch-icon" sizes="114x114" href="/apple-icon-114x114.png">
    <link rel="apple-touch-icon" sizes="120x120" href="/apple-icon-120x120.png">
    <link rel="apple-touch-icon" sizes="144x144" href="/apple-icon-144x144.png">
    <link rel="apple-touch-icon" sizes="152x152" href="/apple-icon-152x152.png">
    <link rel="apple-touch-icon" sizes="180x180" href="/apple-icon-180x180.png">
    <link rel="icon" type="image/png" href="/favicon-32x32.png" sizes="32x32">
    <link rel="icon" type="image/png" href="/android-chrome-192x192.png" sizes="192x192">
    <link rel="icon" type="image/png" href="/favicon-96x96.png" sizes="96x96">
    <link rel="icon" type="image/png" href="/favicon-16x16.png" sizes="16x16">
    <link rel="manifest" href="/manifest.json">
    <meta name="apple-mobile-web-app-title" content="Elastic">
    <meta name="application-name" content="Elastic">
    <meta name="msapplication-TileColor" content="#ffffff">
    <meta name="msapplication-TileImage" content="/mstile-144x144.png">
    <meta name="theme-color" content="#ffffff">
    <meta name="naver-site-verification" content="936882c1853b701b3cef3721758d80535413dbfd">
    <meta name="yandex-verification" content="d8a47e95d0972434">
    <meta name="localized" content="true">
    <meta name="st:robots" content="follow,index">
    <meta property="og:image" content="https://www.elastic.co/static/images/elastic-logo-200.png">
    <link rel="shortcut icon" href="/favicon.ico" type="image/x-icon">
    <link rel="icon" href="/favicon.ico" type="image/x-icon">
    <link rel="apple-touch-icon-precomposed" sizes="64x64" href="/favicon_64x64_16bit.png">
    <link rel="apple-touch-icon-precomposed" sizes="32x32" href="/favicon_32x32.png">
    <link rel="apple-touch-icon-precomposed" sizes="16x16" href="/favicon_16x16.png">
    <!-- Give IE8 a fighting chance -->
    <!--[if lt IE 9]>
    <script src="https://oss.maxcdn.com/html5shiv/3.7.2/html5shiv.min.js"></script>
    <script src="https://oss.maxcdn.com/respond/1.4.2/respond.min.js"></script>
    <![endif]-->
    <link rel="stylesheet" type="text/css" href="/guide/static/styles.css">
  </head>

  <!--© 2015-2021 Elasticsearch B.V. Copying, publishing and/or distributing without written permission is strictly prohibited.-->

  <body>
    <!-- Google Tag Manager -->
    <script>dataLayer = [];</script><noscript><iframe src="//www.googletagmanager.com/ns.html?id=GTM-58RLH5" height="0" width="0" style="display:none;visibility:hidden"></iframe></noscript>
    <script>(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start': new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0], j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src= '//www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f); })(window,document,'script','dataLayer','GTM-58RLH5');</script>
    <!-- End Google Tag Manager -->

    <!-- Global site tag (gtag.js) - Google Analytics -->
    <script async src="https://www.googletagmanager.com/gtag/js?id=UA-12395217-16"></script>
    <script>
      window.dataLayer = window.dataLayer || [];
      function gtag(){dataLayer.push(arguments);}
      gtag('js', new Date());
      gtag('config', 'UA-12395217-16');
    </script>

    <!--BEGIN QUALTRICS WEBSITE FEEDBACK SNIPPET-->
    <script type="text/javascript">
      (function(){var g=function(e,h,f,g){
      this.get=function(a){for(var a=a+"=",c=document.cookie.split(";"),b=0,e=c.length;b<e;b++){for(var d=c[b];" "==d.charAt(0);)d=d.substring(1,d.length);if(0==d.indexOf(a))return d.substring(a.length,d.length)}return null};
      this.set=function(a,c){var b="",b=new Date;b.setTime(b.getTime()+6048E5);b="; expires="+b.toGMTString();document.cookie=a+"="+c+b+"; path=/; "};
      this.check=function(){var a=this.get(f);if(a)a=a.split(":");else if(100!=e)"v"==h&&(e=Math.random()>=e/100?0:100),a=[h,e,0],this.set(f,a.join(":"));else return!0;var c=a[1];if(100==c)return!0;switch(a[0]){case "v":return!1;case "r":return c=a[2]%Math.floor(100/c),a[2]++,this.set(f,a.join(":")),!c}return!0};
      this.go=function(){if(this.check()){var a=document.createElement("script");a.type="text/javascript";a.src=g;document.body&&document.body.appendChild(a)}};
      this.start=function(){var a=this;window.addEventListener?window.addEventListener("load",function(){a.go()},!1):window.attachEvent&&window.attachEvent("onload",function(){a.go()})}};
      try{(new g(100,"r","QSI_S_ZN_emkP0oSe9Qrn7kF","https://znemkp0ose9qrn7kf-elastic.siteintercept.qualtrics.com/WRSiteInterceptEngine/?Q_ZID=ZN_emkP0oSe9Qrn7kF")).start()}catch(i){}})();
    </script><div id="ZN_emkP0oSe9Qrn7kF"><!--DO NOT REMOVE-CONTENTS PLACED HERE--></div>
    <!--END WEBSITE FEEDBACK SNIPPET-->

    <div id="elastic-nav" style="display:none;"></div>
    <script src="https://www.elastic.co/elastic-nav.js"></script>

    <!-- Subnav -->
    <div>
      <div>
        <div class="tertiary-nav d-none d-md-block">
          <div class="container">
            <div class="p-t-b-15 d-flex justify-content-between nav-container">
              <div class="breadcrum-wrapper"><span><a href="/guide/" style="font-size: 14px; font-weight: 600; color: #000;">Docs</a></span></div>
            </div>
          </div>
        </div>
      </div>
    </div>

    <div class="main-container">
      <section id="content">
        <div class="content-wrapper">

          <section id="guide" lang="en">
            <div class="container">
              <div class="row">
                <div class="col-xs-12 col-sm-8 col-md-8 guide-section">
                  <!-- start body -->
                  <div class="page_header">
<strong>IMPORTANT</strong>: No additional bug fixes or documentation updates
will be released for this version. For the latest information, see the
<a href="../current/index.html">current release documentation</a>.
</div>
<div id="content">
<div class="breadcrumbs">
<span class="breadcrumb-link"><a href="index.html">Elasticsearch Guide [7.7]</a></span>
»
<span class="breadcrumb-link"><a href="ingest.html">Ingest node</a></span>
»
<span class="breadcrumb-link"><a href="ingest-processors.html">Processors</a></span>
»
<span class="breadcrumb-node">Dissect Processor</span>
</div>
<div class="navheader">
<span class="prev">
<a href="date-index-name-processor.html">« Date Index Name Processor</a>
</span>
<span class="next">
<a href="dot-expand-processor.html">Dot Expander Processor »</a>
</span>
</div>
<div class="section">
<div class="titlepage"><div><div>
<h2 class="title">
<a id="dissect-processor"></a>Dissect Processor<a class="edit_me edit_me_private" rel="nofollow" title="Editing on GitHub is available to Elastic" href="https://github.com/elastic/elasticsearch/edit/7.7/docs/reference/ingest/processors/dissect.asciidoc">edit</a>
</h2>
</div></div></div>
<p>Similar to the <a class="xref" href="grok-processor.html" title="Grok Processor">Grok Processor</a>, dissect also extracts structured fields out of a single text field
within a document.  However unlike the <a class="xref" href="grok-processor.html" title="Grok Processor">Grok Processor</a>, dissect does not use
<a href="https://en.wikipedia.org/wiki/Regular_expression" class="ulink" target="_top">Regular Expressions</a>. This allows dissect’s syntax to be simple and for
some cases faster than the <a class="xref" href="grok-processor.html" title="Grok Processor">Grok Processor</a>.</p>
<p>Dissect matches a single text field against a defined pattern.</p>
<p>For example the following pattern:</p>
<div class="pre_wrapper lang-txt">
<pre class="programlisting prettyprint lang-txt">%{clientip} %{ident} %{auth} [%{@timestamp}] \"%{verb} %{request} HTTP/%{httpversion}\" %{status} %{size}</pre>
</div>
<p>will match a log line of this format:</p>
<div class="pre_wrapper lang-txt">
<pre class="programlisting prettyprint lang-txt">1.2.3.4 - - [30/Apr/1998:22:00:52 +0000] \"GET /english/venues/cities/images/montpellier/18.gif HTTP/1.0\" 200 3171</pre>
</div>
<p>and result in a document with the following fields:</p>
<div class="pre_wrapper lang-js">
<pre class="programlisting prettyprint lang-js">"doc": {
  "_index": "_index",
  "_type": "_type",
  "_id": "_id",
  "_source": {
    "request": "/english/venues/cities/images/montpellier/18.gif",
    "auth": "-",
    "ident": "-",
    "verb": "GET",
    "@timestamp": "30/Apr/1998:22:00:52 +0000",
    "size": "3171",
    "clientip": "1.2.3.4",
    "httpversion": "1.0",
    "status": "200"
  }
}</pre>
</div>
<p>A dissect pattern is defined by the parts of the string that will be discarded. In the example above the first part
to be discarded is a single space. Dissect finds this space, then assigns the value of <code class="literal">clientip</code> is everything up
until that space.
Later dissect matches the <code class="literal">[</code> and then <code class="literal">]</code> and then assigns <code class="literal">@timestamp</code> to everything in-between <code class="literal">[</code> and <code class="literal">]</code>.
Paying special attention the parts of the string to discard will help build successful dissect patterns.</p>
<p>Successful matches require all keys in a pattern to have a value. If any of the <code class="literal">%{keyname}</code> defined in the pattern do
not have a value, then an exception is thrown and may be handled by the <a class="xref" href="handling-failure-in-pipelines.html" title="Handling Failures in Pipelines">on_failure</a> directive.
An empty key <code class="literal">%{}</code> or a <a class="xref" href="dissect-processor.html#dissect-modifier-named-skip-key">named skip key</a> can be used to match values, but exclude the value from
the final document. All matched values are represented as string data types. The <a class="xref" href="convert-processor.html" title="Convert Processor">convert processor</a>
may be used to convert to expected data type.</p>
<p>Dissect also supports <a class="xref" href="dissect-processor.html#dissect-key-modifiers" title="Dissect key modifiers">key modifiers</a> that can change dissect’s default
behavior. For example you can instruct dissect to ignore certain fields, append fields, skip over padding, etc.
See <a class="xref" href="dissect-processor.html#dissect-key-modifiers" title="Dissect key modifiers">below</a> for more information.</p>
<div class="table">
<a id="dissect-options"></a>
<p class="title"><strong>Table 40. Dissect Options</strong></p>
<div class="table-contents">
<table border="1" cellpadding="4px" summary="Dissect Options">
<colgroup>
<col class="col_1">
<col class="col_2">
<col class="col_3">
<col class="col_4">
</colgroup>
<thead>
<tr>
<th align="left" valign="top">Name</th>
<th align="left" valign="top">Required</th>
<th align="left" valign="top">Default</th>
<th align="left" valign="top">Description</th>
</tr>
</thead>
<tbody>
<tr>
<td align="left" valign="top"><p><code class="literal">field</code></p></td>
<td align="left" valign="top"><p>yes</p></td>
<td align="left" valign="top"><p>-</p></td>
<td align="left" valign="top"><p>The field to dissect</p></td>
</tr>
<tr>
<td align="left" valign="top"><p><code class="literal">pattern</code></p></td>
<td align="left" valign="top"><p>yes</p></td>
<td align="left" valign="top"><p>-</p></td>
<td align="left" valign="top"><p>The pattern to apply to the field</p></td>
</tr>
<tr>
<td align="left" valign="top"><p><code class="literal">append_separator</code></p></td>
<td align="left" valign="top"><p>no</p></td>
<td align="left" valign="top"><p>"" (empty string)</p></td>
<td align="left" valign="top"><p>The character(s) that separate the appended fields.</p></td>
</tr>
<tr>
<td align="left" valign="top"><p><code class="literal">ignore_missing</code></p></td>
<td align="left" valign="top"><p>no</p></td>
<td align="left" valign="top"><p>false</p></td>
<td align="left" valign="top"><p>If <code class="literal">true</code> and <code class="literal">field</code> does not exist or is <code class="literal">null</code>, the processor quietly exits without modifying the document</p></td>
</tr>
<tr>
<td align="left" valign="top"><p><code class="literal">if</code></p></td>
<td align="left" valign="top"><p>no</p></td>
<td align="left" valign="top"><p>-</p></td>
<td align="left" valign="top"><p>Conditionally execute this processor.</p></td>
</tr>
<tr>
<td align="left" valign="top"><p><code class="literal">on_failure</code></p></td>
<td align="left" valign="top"><p>no</p></td>
<td align="left" valign="top"><p>-</p></td>
<td align="left" valign="top"><p>Handle failures for this processor. See <a class="xref" href="handling-failure-in-pipelines.html" title="Handling Failures in Pipelines"><em>Handling Failures in Pipelines</em></a>.</p></td>
</tr>
<tr>
<td align="left" valign="top"><p><code class="literal">ignore_failure</code></p></td>
<td align="left" valign="top"><p>no</p></td>
<td align="left" valign="top"><p><code class="literal">false</code></p></td>
<td align="left" valign="top"><p>Ignore failures for this processor. See <a class="xref" href="handling-failure-in-pipelines.html" title="Handling Failures in Pipelines"><em>Handling Failures in Pipelines</em></a>.</p></td>
</tr>
<tr>
<td align="left" valign="top"><p><code class="literal">tag</code></p></td>
<td align="left" valign="top"><p>no</p></td>
<td align="left" valign="top"><p>-</p></td>
<td align="left" valign="top"><p>An identifier for this processor. Useful for debugging and metrics.</p></td>
</tr>
</tbody>
</table>
</div>
</div>
<div class="pre_wrapper lang-js">
<pre class="programlisting prettyprint lang-js">{
  "dissect": {
    "field": "message",
    "pattern" : "%{clientip} %{ident} %{auth} [%{@timestamp}] \"%{verb} %{request} HTTP/%{httpversion}\" %{status} %{size}"
   }
}</pre>
</div>
<div class="section">
<div class="titlepage"><div><div>
<h3 class="title">
<a id="dissect-key-modifiers"></a>Dissect key modifiers<a class="edit_me edit_me_private" rel="nofollow" title="Editing on GitHub is available to Elastic" href="https://github.com/elastic/elasticsearch/edit/7.7/docs/reference/ingest/processors/dissect.asciidoc">edit</a>
</h3>
</div></div></div>
<p>Key modifiers can change the default behavior for dissection. Key modifiers may be found on the left or right
of the <code class="literal">%{keyname}</code> always inside the <code class="literal">%{</code> and <code class="literal">}</code>. For example <code class="literal">%{+keyname -&gt;}</code> has the append and right padding
modifiers.</p>
<div class="table">
<a id="dissect-key-modifiers-table"></a>
<p class="title"><strong>Table 41. Dissect Key Modifiers</strong></p>
<div class="table-contents">
<table border="1" cellpadding="4px" summary="Dissect Key Modifiers">
<colgroup>
<col class="col_1">
<col class="col_2">
<col class="col_3">
<col class="col_4">
<col class="col_5">
<col class="col_6">
</colgroup>
<thead>
<tr>
<th align="left" valign="top">Modifier</th>
<th align="left" valign="top">Name</th>
<th align="left" valign="top">Position</th>
<th align="left" valign="top">Example</th>
<th align="left" valign="top">Description</th>
<th align="left" valign="top">Details</th>
</tr>
</thead>
<tbody>
<tr>
<td align="left" valign="top"><p><code class="literal">-&gt;</code></p></td>
<td align="left" valign="top"><p>Skip right padding</p></td>
<td align="left" valign="top"><p>(far) right</p></td>
<td align="left" valign="top"><p><code class="literal">%{keyname1-&gt;}</code></p></td>
<td align="left" valign="top"><p>Skips any repeated characters to the right</p></td>
<td align="left" valign="top"><p><a class="xref" href="dissect-processor.html#dissect-modifier-skip-right-padding" title="Right padding modifier (-&gt;)">link</a></p></td>
</tr>
<tr>
<td align="left" valign="top"><p><code class="literal">+</code></p></td>
<td align="left" valign="top"><p>Append</p></td>
<td align="left" valign="top"><p>left</p></td>
<td align="left" valign="top"><p><code class="literal">%{+keyname} %{+keyname}</code></p></td>
<td align="left" valign="top"><p>Appends two or more fields together</p></td>
<td align="left" valign="top"><p><a class="xref" href="dissect-processor.html#dissect-modifier-append-key">link</a></p></td>
</tr>
<tr>
<td align="left" valign="top"><p><code class="literal">+</code> with <code class="literal">/n</code></p></td>
<td align="left" valign="top"><p>Append with order</p></td>
<td align="left" valign="top"><p>left and right</p></td>
<td align="left" valign="top"><p><code class="literal">%{+keyname/2} %{+keyname/1}</code></p></td>
<td align="left" valign="top"><p>Appends two or more fields together in the order specified</p></td>
<td align="left" valign="top"><p><a class="xref" href="dissect-processor.html#dissect-modifier-append-key-with-order">link</a></p></td>
</tr>
<tr>
<td align="left" valign="top"><p><code class="literal">?</code></p></td>
<td align="left" valign="top"><p>Named skip key</p></td>
<td align="left" valign="top"><p>left</p></td>
<td align="left" valign="top"><p><code class="literal">%{?ignoreme}</code></p></td>
<td align="left" valign="top"><p>Skips the matched value in the output. Same behavior as <code class="literal">%{}</code></p></td>
<td align="left" valign="top"><p><a class="xref" href="dissect-processor.html#dissect-modifier-named-skip-key">link</a></p></td>
</tr>
<tr>
<td align="left" valign="top"><p><code class="literal">*</code> and <code class="literal">&amp;</code></p></td>
<td align="left" valign="top"><p>Reference keys</p></td>
<td align="left" valign="top"><p>left</p></td>
<td align="left" valign="top"><p><code class="literal">%{*r1} %{&amp;r1}</code></p></td>
<td align="left" valign="top"><p>Sets the output key as value of <code class="literal">*</code> and output value of <code class="literal">&amp;</code></p></td>
<td align="left" valign="top"><p><a class="xref" href="dissect-processor.html#dissect-modifier-reference-keys">link</a></p></td>
</tr>
</tbody>
</table>
</div>
</div>
<div class="section">
<div class="titlepage"><div><div>
<h4 class="title">
<a id="dissect-modifier-skip-right-padding"></a>Right padding modifier (<code class="literal">-&gt;</code>)<a class="edit_me edit_me_private" rel="nofollow" title="Editing on GitHub is available to Elastic" href="https://github.com/elastic/elasticsearch/edit/7.7/docs/reference/ingest/processors/dissect.asciidoc">edit</a>
</h4>
</div></div></div>
<p>The algorithm that performs the dissection is very strict in that it requires all characters in the pattern to match
the source string. For example, the pattern <code class="literal">%{fookey} %{barkey}</code> (1 space), will match the string "foo bar"
(1 space), but will not match the string "foo  bar" (2 spaces) since the pattern has only 1 space and the
source string has 2 spaces.</p>
<p>The right padding modifier helps with this case. Adding the right padding modifier to the pattern <code class="literal">%{fookey-&gt;} %{barkey}</code>,
It will now will match "foo bar" (1 space) and "foo  bar" (2 spaces)
and even "foo          bar" (10 spaces).</p>
<p>Use the right padding modifier to allow for repetition of the characters after a <code class="literal">%{keyname-&gt;}</code>.</p>
<p>The right padding modifier may be placed on any key with any other modifiers. It should always be the furthest right
modifier. For example: <code class="literal">%{+keyname/1-&gt;}</code> and <code class="literal">%{-&gt;}</code></p>
<p>Right padding modifier example</p>
<div class="informaltable">
<table border="1" cellpadding="4px">
<colgroup>
<col class="col_1">
<col class="col_2">
</colgroup>
<tbody>
<tr>
<td align="left" valign="top"><p><span class="strong strong"><strong>Pattern</strong></span></p></td>
<td align="left" valign="top"><p><code class="literal">%{ts-&gt;} %{level}</code></p></td>
</tr>
<tr>
<td align="left" valign="top"><p><span class="strong strong"><strong>Input</strong></span></p></td>
<td align="left" valign="top"><p>1998-08-10T17:15:42,466          WARN</p></td>
</tr>
<tr>
<td align="left" valign="top"><p><span class="strong strong"><strong>Result</strong></span></p></td>
<td align="left" valign="top">
<div class="ulist itemizedlist">
<ul class="itemizedlist">
<li class="listitem">
ts = 1998-08-10T17:15:42,466
</li>
<li class="listitem">
level = WARN
</li>
</ul>
</div>
</td>
</tr>
</tbody>
</table>
</div>
<p>The right padding modifier may be used with an empty key to help skip unwanted data. For example, the same input string, but wrapped with brackets requires the use of an empty right padded key to achieve the same result.</p>
<p>Right padding modifier with empty key example</p>
<div class="informaltable">
<table border="1" cellpadding="4px">
<colgroup>
<col class="col_1">
<col class="col_2">
</colgroup>
<tbody>
<tr>
<td align="left" valign="top"><p><span class="strong strong"><strong>Pattern</strong></span></p></td>
<td align="left" valign="top"><p><code class="literal">[%{ts}]%{-&gt;}[%{level}]</code></p></td>
</tr>
<tr>
<td align="left" valign="top"><p><span class="strong strong"><strong>Input</strong></span></p></td>
<td align="left" valign="top"><p>[1998-08-10T17:15:42,466]            [WARN]</p></td>
</tr>
<tr>
<td align="left" valign="top"><p><span class="strong strong"><strong>Result</strong></span></p></td>
<td align="left" valign="top">
<div class="ulist itemizedlist">
<ul class="itemizedlist">
<li class="listitem">
ts = 1998-08-10T17:15:42,466
</li>
<li class="listitem">
level = WARN
</li>
</ul>
</div>
</td>
</tr>
</tbody>
</table>
</div>
</div>

<div class="section">
<div class="titlepage"><div><div>
<h4 class="title">
<a id="append-modifier"></a>Append modifier (<code class="literal">+</code>)<a class="edit_me edit_me_private" rel="nofollow" title="Editing on GitHub is available to Elastic" href="https://github.com/elastic/elasticsearch/edit/7.7/docs/reference/ingest/processors/dissect.asciidoc">edit</a>
</h4>
</div></div></div>
<p><a id="dissect-modifier-append-key"></a>Dissect supports appending two or more results together for the output.
Values are appended left to right. An append separator can be specified.
In this example the append_separator is defined as a space.</p>
<p>Append modifier example</p>
<div class="informaltable">
<table border="1" cellpadding="4px">
<colgroup>
<col class="col_1">
<col class="col_2">
</colgroup>
<tbody>
<tr>
<td align="left" valign="top"><p><span class="strong strong"><strong>Pattern</strong></span></p></td>
<td align="left" valign="top"><p><code class="literal">%{+name} %{+name} %{+name} %{+name}</code></p></td>
</tr>
<tr>
<td align="left" valign="top"><p><span class="strong strong"><strong>Input</strong></span></p></td>
<td align="left" valign="top"><p>john jacob jingleheimer schmidt</p></td>
</tr>
<tr>
<td align="left" valign="top"><p><span class="strong strong"><strong>Result</strong></span></p></td>
<td align="left" valign="top">
<div class="ulist itemizedlist">
<ul class="itemizedlist">
<li class="listitem">
name = john jacob jingleheimer schmidt
</li>
</ul>
</div>
</td>
</tr>
</tbody>
</table>
</div>
</div>

<div class="section">
<div class="titlepage"><div><div>
<h4 class="title">
<a id="append-order-modifier"></a>Append with order modifier (<code class="literal">+</code> and <code class="literal">/n</code>)<a class="edit_me edit_me_private" rel="nofollow" title="Editing on GitHub is available to Elastic" href="https://github.com/elastic/elasticsearch/edit/7.7/docs/reference/ingest/processors/dissect.asciidoc">edit</a>
</h4>
</div></div></div>
<p><a id="dissect-modifier-append-key-with-order"></a>Dissect supports appending two or more results together for the output.
Values are appended based on the order defined (<code class="literal">/n</code>). An append separator can be specified.
In this example the append_separator is defined as a comma.</p>
<p>Append with order modifier example</p>
<div class="informaltable">
<table border="1" cellpadding="4px">
<colgroup>
<col class="col_1">
<col class="col_2">
</colgroup>
<tbody>
<tr>
<td align="left" valign="top"><p><span class="strong strong"><strong>Pattern</strong></span></p></td>
<td align="left" valign="top"><p><code class="literal">%{+name/2} %{+name/4} %{+name/3} %{+name/1}</code></p></td>
</tr>
<tr>
<td align="left" valign="top"><p><span class="strong strong"><strong>Input</strong></span></p></td>
<td align="left" valign="top"><p>john jacob jingleheimer schmidt</p></td>
</tr>
<tr>
<td align="left" valign="top"><p><span class="strong strong"><strong>Result</strong></span></p></td>
<td align="left" valign="top">
<div class="ulist itemizedlist">
<ul class="itemizedlist">
<li class="listitem">
name = schmidt,john,jingleheimer,jacob
</li>
</ul>
</div>
</td>
</tr>
</tbody>
</table>
</div>
</div>

<div class="section">
<div class="titlepage"><div><div>
<h4 class="title">
<a id="named-skip-key"></a>Named skip key (<code class="literal">?</code>)<a class="edit_me edit_me_private" rel="nofollow" title="Editing on GitHub is available to Elastic" href="https://github.com/elastic/elasticsearch/edit/7.7/docs/reference/ingest/processors/dissect.asciidoc">edit</a>
</h4>
</div></div></div>
<p><a id="dissect-modifier-named-skip-key"></a>Dissect supports ignoring matches in the final result. This can be done with an empty key <code class="literal">%{}</code>, but for readability
it may be desired to give that empty key a name.</p>
<p>Named skip key modifier example</p>
<div class="informaltable">
<table border="1" cellpadding="4px">
<colgroup>
<col class="col_1">
<col class="col_2">
</colgroup>
<tbody>
<tr>
<td align="left" valign="top"><p><span class="strong strong"><strong>Pattern</strong></span></p></td>
<td align="left" valign="top"><p><code class="literal">%{clientip} %{?ident} %{?auth} [%{@timestamp}]</code></p></td>
</tr>
<tr>
<td align="left" valign="top"><p><span class="strong strong"><strong>Input</strong></span></p></td>
<td align="left" valign="top"><p>1.2.3.4 - - [30/Apr/1998:22:00:52 +0000]</p></td>
</tr>
<tr>
<td align="left" valign="top"><p><span class="strong strong"><strong>Result</strong></span></p></td>
<td align="left" valign="top">
<div class="ulist itemizedlist">
<ul class="itemizedlist">
<li class="listitem">
clientip = 1.2.3.4
</li>
<li class="listitem">
@timestamp = 30/Apr/1998:22:00:52 +0000
</li>
</ul>
</div>
</td>
</tr>
</tbody>
</table>
</div>
</div>

<div class="section">
<div class="titlepage"><div><div>
<h4 class="title">
<a id="reference-keys"></a>Reference keys (<code class="literal">*</code> and <code class="literal">&amp;</code>)<a class="edit_me edit_me_private" rel="nofollow" title="Editing on GitHub is available to Elastic" href="https://github.com/elastic/elasticsearch/edit/7.7/docs/reference/ingest/processors/dissect.asciidoc">edit</a>
</h4>
</div></div></div>
<p><a id="dissect-modifier-reference-keys"></a>Dissect support using parsed values as the key/value pairings for the structured content. Imagine a system that
partially logs in key/value pairs. Reference keys allow you to maintain that key/value relationship.</p>
<p>Reference key modifier example</p>
<div class="informaltable">
<table border="1" cellpadding="4px">
<colgroup>
<col class="col_1">
<col class="col_2">
</colgroup>
<tbody>
<tr>
<td align="left" valign="top"><p><span class="strong strong"><strong>Pattern</strong></span></p></td>
<td align="left" valign="top"><p><code class="literal">[%{ts}] [%{level}] %{*p1}:%{&amp;p1} %{*p2}:%{&amp;p2}</code></p></td>
</tr>
<tr>
<td align="left" valign="top"><p><span class="strong strong"><strong>Input</strong></span></p></td>
<td align="left" valign="top"><p>[2018-08-10T17:15:42,466] [ERR] ip:1.2.3.4 error:REFUSED</p></td>
</tr>
<tr>
<td align="left" valign="top"><p><span class="strong strong"><strong>Result</strong></span></p></td>
<td align="left" valign="top">
<div class="ulist itemizedlist">
<ul class="itemizedlist">
<li class="listitem">
ts = 1998-08-10T17:15:42,466
</li>
<li class="listitem">
level = ERR
</li>
<li class="listitem">
ip = 1.2.3.4
</li>
<li class="listitem">
error = REFUSED
</li>
</ul>
</div>
</td>
</tr>
</tbody>
</table>
</div>
</div>

</div>

</div>
<div class="navfooter">
<span class="prev">
<a href="date-index-name-processor.html">« Date Index Name Processor</a>
</span>
<span class="next">
<a href="dot-expand-processor.html">Dot Expander Processor »</a>
</span>
</div>
</div>

                  <!-- end body -->
                </div>
                <div class="col-xs-12 col-sm-4 col-md-4" id="right_col">
                  <div id="rtpcontainer" style="display: block;">
                    <div class="mktg-promo">
                      <h3>Most Popular</h3>
                      <ul class="icons">
                        <li class="icon-elasticsearch-white"><a href="https://www.elastic.co/webinars/getting-started-elasticsearch?baymax=default&amp;elektra=docs&amp;storm=top-video">Get Started with Elasticsearch: Video</a></li>
                        <li class="icon-kibana-white"><a href="https://www.elastic.co/webinars/getting-started-kibana?baymax=default&amp;elektra=docs&amp;storm=top-video">Intro to Kibana: Video</a></li>
                        <li class="icon-logstash-white"><a href="https://www.elastic.co/webinars/introduction-elk-stack?baymax=default&amp;elektra=docs&amp;storm=top-video">ELK for Logs &amp; Metrics: Video</a></li>
                      </ul>
                    </div>
                  </div>
                </div>
              </div>
            </div>
          </section>

        </div>


<div id="elastic-footer"></div>
<script src="https://www.elastic.co/elastic-footer.js"></script>
<!-- Footer Section end-->

      </section>
    </div>

<script src="/guide/static/jquery.js"></script>
<script type="text/javascript" src="/guide/static/docs.js"></script>
<script type="text/javascript">
  window.initial_state = {}</script>
  </body>
</html>
